SSL certificate expired, website says "Not Secure": how to fix it

First, confirm it's really expiry

A "Not Secure" label or a full-page warning has a few possible causes. Check what you're dealing with before changing anything:

`bash

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \

| openssl x509 -noout -subject -enddate

`

• notAfter is in the past: the certificate expired. Follow the steps below.
• notAfter is in the future, but the subject/name doesn't match the domain: wrong certificate is being served (often a hosting default). This is a configuration problem, not expiry.
• The certificate is valid, and the page shows "Not Secure" only in the address bar, without a full-page warning: probably mixed content. The page loads images or scripts over http://. Fix those URLs.
• Only one visitor sees the error: check that their computer's clock is right. A wrong system date makes valid certificates look expired.

Fix on cPanel / shared hosting (AutoSSL)

1. Log in to cPanel and open SSL/TLS Status.

2. Find the domain. If it shows an error, the message usually says why validation failed.

3. Fix the cause. Common ones:

- DNS for the domain no longer points at this server (for example, the site moved, or a proxy/CDN was added).

- A redirect or security rule blocks requests to /.well-known/ on port 80.

- The domain or subdomain was removed from the account.

4. Click Run AutoSSL and wait for it to finish.

5. Check again with the command above. If the panel shows a new certificate but openssl still shows the old one, contact the host. The server may not have picked it up yet.

If AutoSSL can't issue a certificate and you can't fix the cause quickly, ask the host to install one by hand. Many hosts will do this on a support ticket.

Fix on a VPS with Certbot

`bash

sudo certbot certificates # list certs and their expiry dates

sudo certbot renew --dry-run # test renewal without changing anything

sudo certbot renew # renew anything that's due

`

If the dry run fails, read the error. It usually points to one of these:

• HTTP-01 challenge can't be reached: port 80 is closed, or a redirect sends /.well-known/acme-challenge/ somewhere else.
• DNS has changed: the domain no longer resolves to this server.
• Renewal timer not running: check systemctl list-timers | grep certbot or your cron jobs.

After a successful renewal, reload the web server so it serves the new certificate:

`bash

sudo nginx -t && sudo systemctl reload nginx

sudo apachectl configtest && sudo systemctl reload apache2

`

Forgetting this reload is a classic: the certificate on disk is new, but the server keeps serving the old one from memory.

Behind a CDN or proxy

There are two certificates: the one visitors get from the proxy, and the one between the proxy and your server. Find out which one expired (the openssl check shows the visitor-facing one). Renew that one in the proxy's dashboard, or on the origin server, depending on which it is.

After the fix

• Load the site in a private window and check the certificate's new expiry date.
• Check www. and any other hostnames on the same site. They often expire together.
• If the site sends HSTS headers, visitors couldn't click past the warning while it was expired. Tell the client the outage is over.

Why it happened, and how to stop it happening again

Auto-renewal usually fails without anyone noticing, and the only sign is the expiry date getting closer. Two changes make this more likely now:

• Public certificates issued from 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days in March 2027 and to 47 days in March 2029 (timeline). Each renewal is another chance to fail.
• Let's Encrypt stopped sending expiry reminder emails on 4 June 2025, so many owners no longer get any warning at all.

The fix is a habit, not a tool. Keep a list of every hostname and its expiry date, sorted by days left. Treat anything under 30 days that hasn't renewed as a warning, since that's around when ACME clients normally renew. Get a reminder at 30, 14 and 7 days.

We make Lapsewatch, one simple way to keep that list. Paste example.com, 2026-12-01 lines into its free checker and it sorts them by days left, marking each Expired, Urgent (7 days or less), Soon (30 days or less) or OK. It works from the dates you enter; it doesn't scan your sites. Paid plans add calendar reminders at 30, 14 and 7 days before each expiry.